How can i fix an undefined symbol for the system call Ntcreateprocess prototype in my code?

Question

I want to implement an ssdt hook on a Windows 7 x86 VM and I followed this guide link to guide. In my code I got a linking error of "undefined symbol" that references the system call function I want to hook. in this case "NtCreateProcess".

the errors: LNK2019 unresolved external symbol __imp__NtCreateProcess@32 referenced in function _DriverEntry@8

LNK2001 unresolved external symbol _NtCreateProcess@32

I thought that __declspec(dllimport) tells the linker to ignore the fact that there is no definition because it's in an imported function

#include <ntddk.h>


/* The structure representing the System Service Table. */
typedef struct SystemServiceTable {
    UINT32*     ServiceTable;
    UINT32*     CounterTable;
    UINT32      ServiceLimit;
    UINT32*     ArgumentTable;
} SST;

/* Declaration of KeServiceDescriptorTable, which is exported by ntoskrnl.exe. */
__declspec(dllimport) SST KeServiceDescriptorTable;

//Required information for hooking NtCreateProcess.
__declspec(dllimport) NTSTATUS NTAPI NtCreateProcess(
    OUT PHANDLE           ProcessHandle,
    IN ACCESS_MASK        DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE             ParentProcess,
    IN BOOLEAN            InheritObjectTable,
    IN HANDLE             SectionHandle OPTIONAL,
    IN HANDLE             DebugPort OPTIONAL,
    IN HANDLE             ExceptionPort OPTIONAL);


typedef NTSTATUS(*NtCreateProcessPrototype)(
    OUT PHANDLE           ProcessHandle,
    IN ACCESS_MASK        DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE             ParentProcess,
    IN BOOLEAN            InheritObjectTable,
    IN HANDLE             SectionHandle OPTIONAL,
    IN HANDLE             DebugPort OPTIONAL,
    IN HANDLE             ExceptionPort OPTIONAL);



NtCreateProcessPrototype oldNtCreateProcess = NULL;


/*
 * Disable the WP bit in CR0 register.
 */
void DisableWP() {
    __asm {
        push edx;
        mov edx, cr0;
        and edx, 0xFFFEFFFF;
        mov cr0, edx;
        pop edx;
    }
}

/*
 * Enable the WP bit in CR0 register.
 */
void EnableWP() {
    __asm {
        push edx;
        mov edx, cr0;
        or edx, 0x00010000;
        mov cr0, edx;
        pop edx;
    }
}


/*
 * A function that hooks the 'syscall' function in SSDT.
 */
PULONG HookSSDT(PUCHAR syscall, PUCHAR hookaddr) {
    /* local variables */
    UINT32 index;
    PLONG ssdt;
    PLONG target;

    /* disable WP bit in CR0 to enable writing to SSDT */
    DisableWP();
    DbgPrint("The WP flag in CR0 has been disabled.\r\n");

    /* identify the address of SSDT table */
    ssdt = (PLONG)KeServiceDescriptorTable.ServiceTable;
    DbgPrint("The system call address is %x.\r\n", syscall);
    DbgPrint("The hook function address is %x.\r\n", hookaddr);
    DbgPrint("The address of the SSDT is: %x.\r\n", ssdt);

    /* identify 'syscall' index into the SSDT table */
    index = *((PULONG)(syscall + 0x1));
    DbgPrint("The index into the SSDT table is: %d.\r\n", index);

    /* get the address of the service routine in SSDT */
    target = (PLONG)&(ssdt[index]);
    DbgPrint("The address of the SSDT routine to be hooked is: %x.\r\n", target);

    /* hook the service routine in SSDT */
    return (PULONG)InterlockedExchange(target, (LONG)hookaddr);
}


/*
 * Hook Function.
 */
NTSTATUS Hook_NtCreateProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL) {
    /* local variables */
    NTSTATUS status;

    /* calling new instructions */
    DbgPrint("NtCreateProcess hook called.\r\n");

    /* calling old function */
    status = oldNtCreateProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ParentProcess, InheritObjectTable, SectionHandle, DebugPort, ExceptionPort);
    if (!NT_SUCCESS(status)) {
        DbgPrint("The call to original ZwQuerySystemInformation did not succeed.\r\n");
    }
    return status;
}


/*
 * DriverEntry: entry point for drivers.
 */
NTSTATUS DriverEntry(PDRIVER_OBJECT  pDriverObject, PUNICODE_STRING  pRegistryPath)
{
    NTSTATUS NtStatus = STATUS_SUCCESS;
    unsigned int uiIndex = 0;
    PDEVICE_OBJECT pDeviceObject = NULL;
    UNICODE_STRING usDriverName, usDosDeviceName;

    DbgPrint("DriverEntry Called \r\n");

    RtlInitUnicodeString(&usDriverName, L"\\Device\\MyDriver");
    RtlInitUnicodeString(&usDosDeviceName, L"\\DosDevices\\MyDriver");

    NtStatus = IoCreateDevice(pDriverObject, 0, &usDriverName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDeviceObject);

    if (NtStatus == STATUS_SUCCESS) {
        /* DriverUnload is required to be able to dynamically unload the driver. */
        pDriverObject->DriverUnload = MyDriver_Unload;
        pDeviceObject->Flags |= 0;
        pDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);

        /* Create a Symbolic Link to the device. MyDriver -> \Device\MyDriver */
        IoCreateSymbolicLink(&usDosDeviceName, &usDriverName);

        /* hook SSDT */
        oldNtCreateProcess = (NtCreateProcessPrototype)HookSSDT((PUCHAR)NtCreateProcess, (PUCHAR)Hook_NtCreateProcess);//linking problem is here
    }

    return NtStatus;
}

Answer 1

I thought that __declspec(dllimport) tells the linker to ignore the fact that there is no definition because it's in an imported function

Functions declared with __declspec(dllimport) still need the .lib file for the DLL they are imported from, as noted here:

Note that the users of your DLL still need to link with an import library.

In other words, you're hooped without ntdll.lib, which means you can't build a kernel-mode driver that calls NtCreateProcess or indeed any other function exposed by ntdll.dll.